EXHIBIT 2 



Testing Results from Sunday, January 12, 2003 on the Demo Server running 2.5.0.7. 

10:45 AM Could not log onto the web interface from my laptop. Laptop is 1024x768. 

Think this is a known bug because Suzanne warned me about something 
similar. 

Manually changed the URL to wnappl280.jsp which led me to the logon 
screen. 

1 0:45 AM After logging on to the system, my browser showed a completely white 
page with a strange error code. (I could not copy it down because 
evidently, it logged on a few minutes later before I could cut and paste it.) 
It led me straight to the dashboard like it should have. 

This is almost certainly related to the 10:50 AM note. 
1 0:50 AM While at console, looks like demo server continuously restarts the airids 

service. AiridsTest: no Data Manager heartbeat since xxxxx then proceeds 
to shutdown and restart the service. I started testing at 10:45 AM and it 
looks like it had not seen a heartbeat since 10:33 AM. 
Rebooted the system to fix the problem, and it did not resolve the issue. 

Here is the exact output. Because I don't know the code, I can't be exactly 
sure where it started. It looked like it started at the "no heartbeat" line, but 
it could have also started at the "TestReset: finished, total frames 17" line. 

hmon[1246]: AiridsTest: no Data Manager heartbeat since 10:38:28 
01/12/2003 

hmon[1246]: Test Airids failed: 4 

hmon[1246]]: TestReset: restarting airids 

airids Shutdown [OK] 

wirelessDm Not Currently Running [OK] 

AsyncNotification Shutdown [OK] 

AirDefense AirCommand Stopped 

hmon[1804]: Service: airids stop: status 0 

Database Synchronization [OK] 

AsyncNotification Startup [OK] 

wirelessDm Startup [OK] 

airids Startup [OK] 

AirDefense AirCommand Started 

hmon[2053]; Service airids start: status 0 

hmon[2053]: TestReset: Finished, total frames: 17 

hmon[1246]: Reset status: 0 

I'll have to call Suzanne to correct this behavior. Spoke with her and she 
verified that this is a problem that Dawn, Mike, etc . . . are working on. 



Testing Results from Sunday, January 12, 2003 on the 1 82 QA Server running 2.5.0.5. 



In the HeIp->About box we should list the full version and build number of 
the product. Currently it only lists 2.5. Also, the copyright information 
should be changed to 2003. 

Had to hit the BROWSER'S refresh button in the browser because the 
status light went to red. That worked, it went back to green. There's no 
reason I should have intermittent connectivity problems. After refresh, it 
waited about a minute, then went back to red. Tried hitting the AirDefense 
refresh button and it stayed at red. Switched to the alarm screen (which I 
had not visited before), and all the data loaded as it should have. Looks 
like it might just be a status indicator problem. 

Looked at the /etc/issue file and it has multiple entries of "Built with CVS 
tag ac-2-5-0-5" If we only plan to have one version number in this file, 
then we need to fix our code. If we want to keep a revision history of the 
version numbers over time, then we should list the time at which the 
system underwent an upgrade. 

The "Most Suspicious", "Policy Violations", and "Discovered Access 
Points" sections of the dashboard to not correlate with the "Alarm Filter" 
selection made on the dashboard. The alarm counts are not correct. 
On the Dashboard, in the "Alarm Filter" drop-down, "Summarize by 
TYPE" has the word "TYPE" in all caps. Should be mixed case like the 
others. 

On the Dashboard in the "Discovered Access Points" section, we have 
"Sensor ID" as the header. This should just be "Sensor" to correlate with 
the rest of our pages. Also, the Last Seen column doesn't list the timezone. 
On the Dashboard in the Recent Alarms section - the Last Seen column 
lists the date. Since the dashboard is always a daily view only, this 
shouldn't be needed. If for some reason it is needed, then we need to make 
sure the Last Seen column in the "Discovered Access Points" section also 
has the date. Also, in the "Recent Alarms" section, we say "Last Time" in 
the "Discovered Access Points" section we say "Last Seen". They should 
be the same. 

On the Dashboard in the "Discovered Access Points" section, there is an 

AP with a channel listed as "0". Can we change this to "Undetermined" or 

something like that in order to avoid confusion by the customer. 

On the Dashboard in the "Channel Activity" section for sensor ending in 

f9:lc, there are APs and Stations that it has identified on channels 6 and 1 1; 

however, the sensor is currently locked on channel 14. How/why is this 

happening? 

On a change in connection status from green to red, can we pop up a 
window notifying the user that the system has been disconnected? 
On the Dashboard, for "Recent Alarms" changing the sensor filter setting 
occasionally does not force a screen refresh. I couldn't get this one to 
consistently repeat, but I did notice the same problem on the filter setting 
for the "Channel Activity" one time, but then it seemed to correct itself. 



We should still look into it and see if we can find a pattern. 
12:07 PM On the Dashboard, the "Last Updated" time in the upper left corner appears 

on two lines. It appears on one line in the other screens. It doesn't appear 

at all on the "Reports" screen. 
12:10 PM On the Alarms screen, the "Apply Filter" button is outside of the box that 

has all of the filter settings. If we move it inside the box, it could be more 

obvious. 

12:10 PM On the Alarms screen, the drop down box for "Filter" is too tall. We 
should make it shorter like the one that we have on the Dashboard for 
"Alarm Filter". 

12:15 PM On the Alarms screen, the built-in filters have "(Last 24 hours)", but the 

filter that is actually applied is for today only. We should change "Last 24 
hours" to "Today Only" in the individual alarm filter descriptions. 

1 2:1 8 PM On the Alarms screen, looks like the "Last 24 Hours" filter is also 
incorrect. This is linked to the problem reported at 12:15 PM. 

12:20 PM On the Alarms screen we have the "Adjust Priorities" button. That should 
probably be on the Admin page instead. 

12:32 PM On the Alarms screen, the filter for cleared alarms is not working correctly. 

When you apply it, it shows the exact same thing that "Active" and "All" 
show. I then cleared an alarm, and tried to apply the filter again. This time 
it came up with every alarm again; however, it did list the one that I cleared 
as cleared - but did not list it as acknowledged. 

12:32 PM On the Alarms screen, the "New" count does not take into account the 

Filter settings. So the Total=19 and the New=13 makes it sound like there 
are 13 unique alarms waiting to be added to the system. 

12:36 PM On the Alarms screen, the criticality filters seem to gray out intermittently. 
I couldn't apply a pattern to it. 

12:36 PM On the Alarms screen, in the Time filter drop down, when you make a new 
selection, the grayed out items to the right do not update. That would be a 
nice to add if it is quick; otherwise, we can do it in the future. 

12:43 PM On the Alarms screen, after clicking Basic or Advanced, under the "Limit 
Query to" section, we have a button that says "Device Address". We 
should make that consistent with other screens and say "Device". 

1 2:48 PM On the various Search pages, the search is case sensitive. We should 
change it to disregard case. 

12:50 PM On the Sensor screen, the data for a particular sensor looks run together. 
We need to add some grouping to make it more legible. 

12:50 PM On the Sensor screen, there is a selection for the Secondary AirCommand 
IP but not for the primary 

12:56 PM On rollovers, the first line should have the description of the device, i.e. 
"Ad-hoc Station" or "Authorized Access Point" 

12:58 PM When creating locations and groups, two groups that are in different 
locations should be able to have the same name. i.e. 
Location=HQ 5 Group=FirstFloor, and Location=Satellite,Group=FirstFloor 



Testing Results from Thursday, January 16, 2003 on the 184 QA Server running 2.5.0.10. 



8:59 AM Channel policy alarms still appear for an authorized station. 

9:04 AM After clearing the database and going back into the web interface, there 
was an alarm for a missing sensor. When I went to look, the sensor was 
listed as active. This is probably not a big deal at all. 

9:07 AM Cleared an alarm, then filtered for only cleared alarms. It showed the one 
that a cleared, but it did not appear to have been acknowledged. Then I 
applied a filter that showed all alarms (cleared and not cleared) and the 
alarm that I had cleared showed up as both cleared and acknowledged. 

9:10 AM After acknowledging an alarm while the alarm manager was in summary 

view (by device and type), then committing the change, I was unable to un- 
acknowledge the alarm. This might be by design??? 

9:12 AM The "Default" configuration policy should have all rates allowed by 
default. 

9:20 AM System allowed me to authorize a station for an unauthorized access point 
Is this supposed to happen??? After I authorized it and put it on the watch 
list, I went back to the dashboard and it displayed a "On Watch List" alarm 
and specified the correct device; however, it had an unauthorized station 
icon next to it (the icon did correctly indicate that the system is on the 
watch list). 1 also checked to make sure that this was consistent with the 
alarm manager, and it was also incorrect in the exact same manner that the 
dashboard was incorrect. Finally, I rechecked the dashboard, and in the 
system summary section it listed 1 authorized station. The only one that 
could have been considered authorized was my machine. To sum this up: 
1) should we be able to authorize stations for unauthorized MACs and 2) it 
seems like the display icons for stations are incorrect on the dashboard 
view of alarms and in the alarm manager. 

9:23 AM In Policy manager, one of the sensors picked up a station that had not 

associated with any access point; however, it had an IP address associated 
with it. Not sure how we can pick up the IP address without the station 
associating, but more importantly, the IP address that it listed was 
172.16.96.96 which is the wired (I believe) default gateway on the wireless 
network. Not sure what is going on there. 

9:35 AM In Sensor Manager, the area where we identify the sensor itself in the tree 
view did not display the full MAC address. Before noticing this, I 
switched from the default preference of display by MAC address to display 
by IP address then to display by name. If I switch back to prefer to view 
by MAC address for sensors, it shows the whole MAC address. 

9:40 AM (Reported once before) On the dashboard, in the Most Suspicious list, one 
MAC address is listed multiple times. Both lines indicate equal number of 
alarms. 

9:50 AM After setting an AP on the Ignore List, I went back to alarm manager, 

refreshed the screen, and the icon still appeared as red. Is this because the 
AP was unauthorized at some point today even though it is ignored right 
now? 



On the reports screen, after hitting print, the Display in Browser feature 
doesn't seem to work. 

In the Device List report, under type, we should state "Unauthorized 
Station" or "Authorized Access Point" instead of just "Station" or just 
"Access Point". When you print the report, the icons do not display, so 
determining their authorization is impossible. 

In the Device List report, the same device is sometimes listed twice. I 
noticed this with the infamous "test" device which was listed as a station 
and as an access point. I didn't see any others that did this, so maybe it's 
some weird thing with the "test" AP, 

On the Health Summary report, in the "Top 5 Stations by Utilization" 
section, two devices are listed more than one time. My laptop is listed 
three times, and another station is listed twice. 

On the Sensor Channel View report, I could not scroll all of the way down 

in the browser window (i.e. using the browser scroll bar) I could not find 

any other scroll bars that could be used to get me down to the rest of the 

report. It stopped just shy of the last legend icon for the graphs. 

On the Access Point summary report, in the Frame Statistics section, we 

should remove the "Error Frames" heading, Scott told me it is not in use. 

Unauthorized APs Report, my station is on the watch list, but the icon did 

not have the little W in the middle. 

Probing Stations Report - all station icons are purple. 



